Whether it can be easily applied to Canon Digic 6 firmware or not, I don't know.
Nice presentation, but I think I'll stick with my stone-age methods
I have finally found the third firmware image inside the sx280 102b ROM.
The image starts in ROM @ 0xfc4d350c, it is 0x50ce4 bytes long, it's copied to RAM starting at 0x600000. Its variables are placed after the image, so they are separated from everything else.
I haven't been able to find out when and how the image is copied The code that does copying and initing that core is called from the main core's Startup task.. An obviously related, much smaller data block (from 0xfc481208, length 0x1610, seems to be ARM/thumb startup code) is copied to 0xdff00000.
(edited from here on, after some research)
There seems to be larger areas reserved for use by this core (above 0x800000, above 0x900000). The core is probably active but I suspect that its clock is reduced when not doing ...
face recognition. The user tasks are: "FaceRecogTask" and "DetRecogT". There are interfacing tasks running on the main core. I don't know how the cores are communicating, it could be through shared memory. This core also has a "ClockSave" task, very likely power management.
The address range that the main core sees as 0xdff00000 seems to be the zero address of this core (and it's probably TCM). This core has no bootloader (of course, would not make any sense), the startup code starts in that TCM.